WO2023223440A1

WO2023223440A1 - Image processing device, attack countering method, and attack countering program

Info

Publication number: WO2023223440A1
Application number: PCT/JP2022/020591
Authority: WO
Inventors: 義博小関
Original assignee: 三菱電機株式会社
Priority date: 2022-05-17
Filing date: 2022-05-17
Publication date: 2023-11-23
Also published as: JPWO2023223440A1

Abstract

A first detection unit (121) executes object detection for a subject image. A processing unit (130) generates a paint-out image for each bounding box in the subject image, which is the subject image with the bounding box painted out. For each paint-out image, a second detection unit (122) executes the object detection for the paint-out image. On the basis of score values of the individual bounding boxes in the subject image, as well as score values of the individual bounding boxes in the set of paint-out images, a determination unit (140) determines whether or not an adversarial sample patch attack has been conducted.

Description

Image processing device, attack countermeasure method, and attack countermeasure program

The present disclosure relates to countermeasure techniques against hostile sample patch attacks.

Object detection indicates the position of each object shown in the input image using a bounding box, and indicates the type (label) of each object.
In recent years, deep learning methods using neural networks have achieved extremely high accuracy in object detection tasks.

An image classifier is constructed using deep learning. Additionally, adversarial examples attacks on image classifiers are known.
Adversarial sample attacks falsify the classification results obtained from multiclass classifiers by adding perturbations to the input data.

Non-Patent Document 1 discloses an attack method different from a method of electronically adding perturbation to an input image in an object detection task.
The attack method involves physically placing an adversarial sample patch printed with a perturbation image, and escaping object detection when the image obtained by photographing it is input.

The present disclosure aims to make it possible to detect an attack that obstructs object detection using an adversarial sample patch.

The image processing device of the present disclosure includes:
a first detection unit that calculates a bounding box and a score value for each object detected from the target image by performing object detection on the target image;
a processing unit that obtains a group of filled images by generating the target image in which the bounding box is filled in for each of the bounding boxes of the target image as a filled image;
a second detection unit that calculates a bounding box and a score value for each object detected from the filled image by performing the object detection on the filled image for each filled image;
Based on the score value of each bounding box of the target image and the score value of each bounding box of the filled image group, it is determined whether an adversarial sample patch attack for placing an adversarial sample patch on the target image has been performed. A determination section;
Equipped with.

According to the present disclosure, an attack can be detected when an attack that obstructs object detection is performed using a hostile sample patch.

FIG. 1 is a configuration diagram of an image processing apparatus 100 in Embodiment 1. FIG. 1 is a functional configuration diagram of an image processing apparatus 100 in Embodiment 1. 5 is a flowchart of an attack countermeasure method in Embodiment 1. Flowchart of step S150 in Embodiment 1. FIG. 3 is a diagram showing object detection for a target image 200 in the first embodiment. FIG. 3 is a diagram showing object detection for a filled-in image 210 in the first embodiment. FIG. 3 is a diagram showing object detection for a filled-in image 220 in the first embodiment. FIG. 3 is a diagram showing object detection for a filled-in image 230 in the first embodiment. 1 is a hardware configuration diagram of an image processing apparatus 100 in Embodiment 1. FIG.

In the embodiments and drawings, the same or corresponding elements are given the same reference numerals. Descriptions of elements assigned the same reference numerals as explained elements will be omitted or simplified as appropriate. Arrows in the figure mainly indicate the flow of data or processing.

Embodiment 1.
Countermeasures against hostile sample patch attacks will be explained based on FIGS. 1 to 9.

***Explanation of configuration***
The configuration of the image processing device 100 will be explained based on FIG. 1. The image processing device 100 is also referred to as an attack countermeasure device.
The image processing device 100 is a computer that includes hardware such as a processor 101, a memory 102, an auxiliary storage device 103, a communication device 104, and an input/output interface 105. These pieces of hardware are connected to each other via signal lines.

The processor 101 is an IC that performs arithmetic processing and controls other hardware. For example, processor 101 is a CPU.
IC is an abbreviation for Integrated Circuit.
CPU is an abbreviation for Central Processing Unit.

Memory 102 is a volatile or non-volatile storage device. Memory 102 is also called main storage or main memory. For example, memory 102 is a RAM. The data stored in memory 102 is saved in auxiliary storage device 103 as needed.
RAM is an abbreviation for Random Access Memory.

The auxiliary storage device 103 is a nonvolatile storage device. For example, the auxiliary storage device 103 is a ROM, an HDD, a flash memory, or a combination thereof. Data stored in the auxiliary storage device 103 is loaded into the memory 102 as needed.
ROM is an abbreviation for Read Only Memory.
HDD is an abbreviation for Hard Disk Drive.

Communication device 104 is a receiver and transmitter. For example, communication device 104 is a communication chip or NIC. Communication between the image processing device 100 is performed using a communication device 104.
NIC is an abbreviation for Network Interface Card.

The input/output interface 105 is a port to which an input device and an output device are connected. For example, the input/output interface 105 is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display. Input/output of the image processing apparatus 100 is performed using an input/output interface 105.
USB is an abbreviation for Universal Serial Bus.

The image processing device 100 includes elements such as a reception section 110, a detection section 120, a processing section 130, a determination section 140, and an output section 150. The detection unit 120 includes a first detection unit 121 and a second detection unit 122. These elements are implemented in software.

The auxiliary storage device 103 stores an attack countermeasure program for making the computer function as a receiving section 110, a detecting section 120, a processing section 130, a determining section 140, and an output section 150. The attack countermeasure program is loaded into memory 102 and executed by processor 101.
The auxiliary storage device 103 further stores an OS. At least a portion of the OS is loaded into memory 102 and executed by processor 101.
The processor 101 executes an attack countermeasure program while executing the OS.
OS is an abbreviation for Operating System.

Input/output data of the attack countermeasure program is stored in the storage unit 190.
The memory 102 functions as a storage unit 190. However, storage devices such as the auxiliary storage device 103, a register in the processor 101, and a cache memory in the processor 101 may function as the storage unit 190 instead of the memory 102 or together with the memory 102.

The image processing device 100 may include a plurality of processors that replace the processor 101.

The attack countermeasure program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

FIG. 2 shows the functional configuration of the image processing apparatus 100.
The functions of each element of the image processing device 100 will be described later.

***Operation explanation***
The operation procedure of the image processing device 100 corresponds to an attack countermeasure method. Further, the operation procedure of the image processing device 100 corresponds to the processing procedure by an attack countermeasure program.

The attack countermeasure method will be explained based on FIG. 3.
In step S110, the receiving unit 110 receives the target image 191.
For example, a user inputs a target image 191 into the image processing device 100. Then, the receiving unit 110 receives the input target image 191.

The target image 191 is an image processed in the attack countermeasure method.
Target image 191 shows one or more objects. When an adversarial sample patch attack is performed, an adversarial sample patch is placed on a portion of the object shown in the target image 191.
Adversarial sample patch attacks impede object detection on images by placing adversarial sample patches on the images. An adversarial sample patch attack is an example of an adversarial sample attack, and is also referred to as an attack or an adversarial patch attack.
An adversarial sample patch is an example of an adversarial sample, and is also referred to as a patch or an adversarial patch.

In step S120, the first detection unit 121 performs object detection on the target image 191.
As a result, a bounding box, score value, and label are calculated for each object detected from the target image 191. That is, one or more sets of bounding boxes, score values, and labels are calculated.

Object detection is a process of detecting one or more objects shown in an image, and calculates a bounding box, score value, and label for each detected object.
The bounding box indicates the area that encompasses the detected object. The position and range of the bounding box are specified by coordinate values in the image.
The score value indicates the confidence level of the bounding box. The score value is also referred to as a score or confidence score.
The label indicates the type of object detected.

For example, the first detection unit 121 operates an object detector using the target image 191 as input. The object detector is prepared in advance.
Object detectors are built using machine learning, for example. Specifically, the object detector is built using deep learning. For example, an object detector corresponds to a trained model and is implemented in software.
As a technology for object detection, YOLO, SSD, Faster R-CNN, etc. are used.
YOLO is an abbreviation for You Only Look Once.
SSD is an abbreviation for Single Shot MultiBox Detector.
R-CNN is an abbreviation for Region Based Convolutional Neural Networks.

In step S130, the processing unit 130 generates a filled-in image for each bounding box of the target image 191. As a result, a group of filled-in images is obtained.
The filled image is the target image 191 in which the bounding box is filled in. Specifically, the bounding box is filled with a single color.
The filled image group is one or more filled images.

The filled image group is obtained as follows.
First, the processing unit 130 selects each score value within a predetermined range from one or more score values of the target image 191. The predetermined range is a predetermined range for score values.
Next, the processing unit 130 selects a bounding box corresponding to each selected score value.
The processing unit 130 then generates a filled-in image for each selected bounding box.

In step S140, the second detection unit 122 performs object detection on the filled-in image for each filled-in image. The method of object detection is the same as the method in step S120.
As a result, a bounding box, score value, and label are calculated for each object detected from the filled image. That is, one or more sets of bounding boxes, score values, and labels are calculated.

In step S150, the determination unit 140 determines whether a hostile sample patch attack has been performed based on the score value of each bounding box of the target image 191 and the score value of each bounding box of the filled-in image group.

The procedure of step S150 will be explained based on FIG. 4.
In step S151, the determination unit 140 selects the maximum score value in the target image 191. That is, the determination unit 140 selects the maximum score value from one or more score values of the target image 191.

In step S152, the determination unit 140 selects the maximum score value in the group of filled-in images. That is, the determination unit 140 selects the maximum score value from one or more score values of the filled-in image group.

In step S153, the determination unit 140 calculates the difference between the maximum score value in the target image 191 and the maximum score value in the filled-in image group. The calculated difference is referred to as a score difference.
Specifically, the determination unit 140 calculates the score difference by subtracting the maximum score value in the target image 191 from the maximum score value in the filled-in image group.

In S154, the determination unit 140 compares the score difference with a threshold value and determines the magnitude relationship between the score difference and the threshold value. The threshold value is determined in advance.
If the score difference is greater than or equal to the threshold, the process proceeds to step S155.
If the score difference is less than the threshold, the process proceeds to step S156.

In step S155, the determination unit 140 determines that a hostile sample patch attack has been performed.

In step S156, the determination unit 140 determines that a hostile sample patch attack has not been performed.

Returning to FIG. 3, the explanation will be continued.
The determination unit 140 sends the determination flag and the detection result to the output unit 150. The output unit 150 receives the determination flag and the detection result from the output unit 150.
The determination flag and detection results will be described later.

In step S160, the output unit 150 outputs the processing result 192. For example, the output unit 150 displays the processing result 192 on a display.
The processing result 192 includes a determination flag and a detection result.

The determination flag indicates whether or not a hostile sample patch attack has been performed.
If it is determined that an adversarial sample patch attack has been performed, the detection results are the bounding box corresponding to the maximum score value in the filled image group and the object detection result for the target image 191.
The bounding box corresponding to the maximum score value in the filled-in image group becomes a bounding box candidate for the object shown in the target image 191.
The result of object detection for the target image 191 shows a bounding box, a score value, and a label for each object detected from the target image 191.
If it is not determined that a hostile sample patch attack has been performed, the detection result is the result of object detection for the target image 191.

The attack countermeasure method will be supplemented based on FIGS. 5 to 8.
FIG. 5 shows a target image 200. Target image 200 is an example of target image 191 that has been subjected to an adversarial sample patch attack.
A person is shown in the target image 200. A person is an example of an object to be detected.
The hostile sample patch 209 is placed over the person.
The bounding boxes (201 to 203) are bounding boxes calculated by object detection for the target image 200.
Due to the influence of the adversarial sample patch 209, the recognition score (score value) of each bounding box is low. However, each bounding box has a recognition score of a certain size. The recognition score of each bounding box is a value within a predetermined range (0.1 or more and 0.6 or less).
Each bounding box (201-203) is filled assuming that a bounding box with a recognition score within a predetermined range appears near the adversarial sample patch 209.
FIG. 6 shows a filled-in image 210. The filled-in image 210 is a filled-in image obtained by filling in the bounding box 201.
The bounding boxes (211, 212) are bounding boxes calculated by object detection on the filled-in image 210.
FIG. 7 shows a filled-in image 220. The filled image 220 is a filled image obtained by filling in the bounding box 202.
The bounding box (221) is a bounding box calculated by object detection for the filled-in image 220.
FIG. 8 shows a filled-in image 230. The filled image 230 is a filled image obtained by filling in the bounding box 203.
The bounding boxes (231, 232) are bounding boxes calculated by object detection for the filled-in image 230.

If the fill covers the adversarial sample patch 209 well, the bounding box recognition score for the person increases.
Therefore, the maximum value of the recognition score in the group of filled-in images (210 to 230) is higher than the maximum value of the recognition score in the target image 200.
For example, if the maximum recognition score in the target image 200 is 0.36 and the maximum recognition score in the filled image group (210 to 230) is 0.64, the maximum recognition score increases by 0.28. That's what I did.
The fact that the maximum value of the recognition score increases by a certain degree due to filling means that the recognition score of the target image 200 has been lowered by the adversarial sample patch attack. Then, the bounding box corresponding to the maximum recognition score in the group of filled-in images (210 to 230) becomes a bounding box candidate for the person.

***Effects of Embodiment 1***
According to the first embodiment, when an attack that obstructs object detection is performed using a hostile sample patch, it is possible to detect the attack.
Furthermore, it is possible to output bounding box candidates that should originally be output.

***Features of Embodiment 1***
Embodiment 1 addresses an adversarial sample patch attack on object detection.
The image processing device 100 estimates the position of the hostile sample patch based on the score value of the bounding box output by the object detector for the input image. Then, the image processing device 100 reduces the effect of the attack by filling out the estimated position.
The object detector calculates, for the input image, coordinates representing the position of each object's bounding box, a label representing the type of object within the bounding box, and a score value corresponding to probability as a confidence level. Output.

The image processing device 100 inputs an image to an object detector. The object detector calculates the bounding box and score value.
When the score value falls within a certain threshold value, the image processing device 100 generates an image in which the area within the corresponding bounding box is filled with a single color. One image is generated for each applicable bounding box.
The image processing device 100 inputs the filled-in image group to the object detector again. The object detector calculates a bounding box and a score value for each input image.
If the maximum score value among the plurality of newly obtained score values exceeds the maximum score value in the original image by a certain amount or more, the image processing device 100 reduces the effectiveness of the attack by filling out the hostile sample patch. judge that it has been done. The image processing device 100 then outputs the attack detection. Further, the image processing device 100 outputs the bounding box having the highest score value in the group of filled-in images as a candidate bounding box for the target of the attack.

First, the image processing apparatus 100 calculates a bounding box and a score value for an image input for object detection.
Next, the image processing device 100 generates, for each applicable bounding box, an image in which bounding boxes whose score values fall within a certain range are filled in.
Next, the image processing device 100 performs object detection again for each generated image.
Then, if the difference between the maximum score values before and after filling is equal to or greater than a certain threshold, the image processing apparatus 100 determines that a hostile sample patch attack is being performed. In this case, the image processing device 100 outputs a bounding box having a flag indicating attack detection and a maximum score value after filling.

***Supplement to Embodiment 1***
The hardware configuration of the image processing device 100 will be described based on FIG. 9.
The image processing device 100 includes a processing circuit 109.
The processing circuit 109 is hardware that implements the reception section 110, the detection section 120, the processing section 130, the determination section 140, and the output section 150.
The processing circuit 109 may be dedicated hardware or may be the processor 101 that executes a program stored in the memory 102.

When processing circuit 109 is dedicated hardware, processing circuit 109 is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.
ASIC is an abbreviation for Application Specific Integrated Circuit.
FPGA is an abbreviation for Field Programmable Gate Array.

The image processing device 100 may include a plurality of processing circuits that replace the processing circuit 109.

In the processing circuit 109, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

In this way, the functions of the image processing device 100 can be realized by hardware, software, firmware, or a combination thereof.

Embodiment 1 is an illustration of a preferred embodiment and is not intended to limit the technical scope of the present disclosure. Embodiment 1 may be implemented partially or in combination with other embodiments. The procedures described using flowcharts and the like may be modified as appropriate.

The "unit" of each element of the image processing device 100 may be read as "process", "process", "circuit", or "circuitry".

100 image processing device, 101 processor, 102 memory, 103 auxiliary storage device, 104 communication device, 105 input/output interface, 109 processing circuit, 110 reception unit, 120 detection unit, 121 first detection unit, 122 second detection unit, 130 Processing unit, 140 Judgment unit, 150 Output unit, 190 Storage unit, 191 Target image, 192 Processing result, 200 Target image, 201 Bounding box, 202 Bounding box, 203 Bounding box, 209 Adversarial sample patch, 210 Filled image, 211 Bounding box, 212 bounding box, 220 filled image, 221 bounding box, 230 filled image, 231 bounding box, 232 bounding box.

Claims

a first detection unit that calculates a bounding box and a score value for each object detected from the target image by performing object detection on the target image;
a processing unit that obtains a group of filled images by generating the target image in which the bounding box is filled in for each of the bounding boxes of the target image as a filled image;
a second detection unit that calculates a bounding box and a score value for each object detected from the filled image by performing the object detection on the filled image for each filled image;
Based on the score value of each bounding box of the target image and the score value of each bounding box of the filled image group, it is determined whether an adversarial sample patch attack for placing an adversarial sample patch on the target image has been performed. A determination section;
An image processing device comprising:
The processing unit selects each score value within a predetermined range from one or more of the score values of the target image, selects the bounding box corresponding to each selected score value, and selects the bounding box corresponding to each selected score value. The image processing device according to claim 1, wherein the image processing device generates the filled-in image every time.
The determination unit selects the maximum score value in the target image and the maximum score value in the filled image group, and calculates the difference between the maximum score value in the target image and the maximum score value in the filled image group as a score difference, The image processing apparatus according to claim 1 or 2, wherein it is determined whether the hostile sample patch attack has been performed based on the score difference.
The image processing according to claim 3, further comprising an output unit that outputs a processing result indicating the bounding box corresponding to the maximum score value in the filled image group when it is determined that the adversarial sample patch attack has been performed. Device.
calculating a bounding box and a score value for each object detected from the target image by performing object detection on the target image;
Obtaining a group of filled images by generating the target image in which the bounding box is filled in for each of the bounding boxes of the target image as a filled image,
calculating a bounding box and a score value for each object detected from the filled image by performing the object detection on the filled image for each filled image;
Based on the score value of each bounding box of the target image and the score value of each bounding box of the filled image group, it is determined whether an adversarial sample patch attack for placing an adversarial sample patch on the target image has been performed. Attack countermeasure methods.
a first detection process of calculating a bounding box and a score value for each object detected from the target image by performing object detection on the target image;
processing for obtaining a group of filled images by generating the target image in which the bounding box is filled in for each of the bounding boxes of the target image as a filled image;
a second detection process of calculating a bounding box and a score value for each object detected from the filled image by performing the object detection on the filled image for each filled image;
Based on the score value of each bounding box of the target image and the score value of each bounding box of the filled image group, it is determined whether an adversarial sample patch attack for placing an adversarial sample patch on the target image has been performed. Judgment processing and
An anti-attack program that allows computers to execute